An enterprise implements a hub-and-spoke network topology in Azure. The topology contains … — Microsoft Azure Solutions Architect (AZ-305)

An enterprise implements a hub-and-spoke network topology in Azure. The topology contains a hub virtual network named `vnet-weur-hub` ( $10.10.0.0/16$ ) and a spoke virtual network named `vnet-weur-spoke` ( $10.20.0.0/16$ ). A network virtual appliance (NVA) is deployed in the hub at $10.10.1.4$ .

You need to configure routing for the subnets in `vnet-weur-spoke` to meet the following requirements:
1. All traffic destined for the internet must route through the NVA at $10.10.1.4$ .
2. All traffic destined for resources within `vnet-weur-spoke` must route directly between those resources.

Which two routes must be active in the effective routes of `vnet-weur-spoke` to meet these requirements? (Select two.)

A user-defined route with the address prefix $0.0.0.0/0$ and a next hop type of Virtual appliance pointing to $10.10.1.4$ .Cevap
A system-defined route with the address prefix $10.20.0.0/16$ and a next hop type of Virtual network.Cevap
C
A user-defined route with the address prefix $10.20.0.0/16$ and a next hop type of Virtual appliance pointing to $10.10.1.4$ .
D
A system-defined route with the address prefix $0.0.0.0/0$ and a next hop type of Internet.

Cevap

A user-defined route with the address prefix

0.0.0.0/0

pointing to the virtual appliance at

10.10.1.4

as next hop, and the default system-defined route with the address prefix

10.20.0.0/16

pointing to the Virtual network.

The correct configurations include the user-defined route for

0.0.0.0/0

pointing to the firewall's IP address of

10.10.1.4

, which overrides the default internet path and routes all external traffic through the firewall. Additionally, the default system-defined route for the local virtual network prefix (

10.20.0.0/16

with next hop Virtual network) must remain the active route for internal traffic. Since Azure routing uses Longest Prefix Match (LPM), the local system route (

10.20.0.0/16

) takes precedence over the user-defined route (

0.0.0.0/0

) for any traffic destined within the spoke, allowing local traffic to bypass the firewall without requiring extra UDRs.

Adım Adım Çözüm

Analyze the requirement for outbound internet traffic routing.

To route all outbound internet traffic (

0.0.0.0/0

) to the NVA at

10.10.1.4

, we must define a User-Defined Route (UDR) with prefix

0.0.0.0/0

and next hop Virtual appliance pointing to

10.10.1.4

. This overrides the default system route for internet traffic.

By default, Azure routes internet-bound traffic directly to the Internet. A UDR is required to override this default behavior.

Analyze the requirement for internal spoke-to-spoke traffic routing.

Traffic within `vnet-weur-spoke` (

10.20.0.0/16

) is handled by the default system route with the prefix

10.20.0.0/16

and next hop Virtual network.

Azure system routes automatically handle intra-VNet routing. Leaving this route active allows direct local communication without traversing the hub firewall.

Evaluate route precedence (Longest Prefix Match).

For local traffic (e.g., to

10.20.1.5

), Azure evaluates both routes:

10.20.0.0/16

(system route) and

0.0.0.0/0

(UDR). The system route is a longer prefix match, so it takes precedence.

Longest Prefix Match ensures that local traffic is routed locally, while all other traffic falls back to the

0.0.0.0/0

default route pointing to the firewall.

Anahtar Kavram

Azure virtual network routing uses User-Defined Routes (UDRs) to override default system routes. Azure selects routes based on the Longest Prefix Match (LPM) algorithm. A route for

0.0.0.0/0

redirects all non-local traffic to the specified next hop (NVA/firewall), while local traffic continues to route directly via the system route for the VNet's CIDR block.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru